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ABSTRACT 

The presence of third-party tracking on websites has be- 
come customary. However, our understanding of the third- 
party ecosystem is still very rudimentary. We examine third- 
party trackers from a geographical perspective, observing 
the third-party tracking ecosystem from 29 countries across 
the globe. When examining the data by region (North Amer- 
ica, South America, Europe, East Asia, Middle East, and 
Oceania), we observe significant geographical variation be- 
tween regions and countries within regions. We find trackers 
that focus on specific regions and countries, and some that 
are hosted in countries outside their expected target track- 
ing domain. Given the differences in regulatory regimes 
between jurisdictions, we believe this analysis sheds light 
on the geographical properties of this ecosystem and on the 
problems that these may pose to our ability to track and man- 
age the different data silos that now store personal data about 
us all. 
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1. INTRODUCTION 

The rise in use of personal data and sophisticated algo- 
rithms on individuals' online browsing behaviour and inter- 
ests has lead to increasing presence of third-party advertising 
and analytics services on the Internet and the mobile web [ 1 , 

2, 3]. These services aim to build a user profile by collection, 
aggregation, and correlation of an individual's browsing be- 
haviour, demographics, interests, and temporal/spatial pat- 
terns of behaviour (e.g., through smartphone localisation, or 
location check-ins on Online Social Networks). While these 
services are vital for the online economy, there are complex 
debates over privacy issues which are caused directly or indi- 
rectly (e.g., misusing ad tracker cookies to identify individ- 
uals [4]) by such services. Despite legal or regulatory efforts 
on personal data collection and storage, existence of thou- 
sands of these third party services [3] across the world un- 


der different names and legal constraints makes holding indi- 
vidual businesses responsible for their actions a challenging 
task. 

In this paper we investigate the geographic diversity and 
footprint of thousands of third party domains across the world, 
using measurements from tens of vantage points distributed 
across nearly all continents. As a result, we shed light on 
the third party tracking and analytics industry across legal 
and geographic boundaries. Several recent works have high- 
lighted the footprint of companies such as Google as dom- 
inant corporations and United States as a specific prevalent 
country in the third-party tracking market [5, 2]. Consid- 
ering the role of technology, legislation and economics in 
privacy problem [6], we believe that understanding regional 
differences in the tracking ecosystem is essential for pro- 
viding effective privacy regulations, in addition to ability to 
understand the trade of personal data. 

We gathered data from 28 countries using PlanetLab 1 nodes 
(§2). We first analyse our dataset by dividing our data on a 
regional basis (§3), considering the major and minor players 
in each region separately. We find a significant difference in 
the presence and dominance of local third-parties in differ- 
ent regions. While we observe an even distribution of local 
third-parties in countries within Europe, East Asia, Ocea- 
nia and South America, in contrast, Turkey and Israel in the 
Middle East appear much stronger in terms of their num- 
ber of local third-parties. We then analyse our data using the 
country code TLD (Top Level Domain name) of each tracker 
(§4) to reveal a complex, interwoven set of cross-country re- 
lationships between third-party tracking services. We find 
extensive presence of European third-party trackers in the 
popular websites of East Asia and the Middle East. In par- 
ticular, Germany and Russia third-parties are present across 
popular websites of all investigated countries in our dataset. 
Similarly, third-parties based in North America, mostly US, 
are broadly embedded in popular websites of the Middle 
East. We hypothesise that the reasons for the observed cross- 
country tracking is related to the substantial differences in 
privacy regulation in these countries. After a discussion of 
related work (§6), we conclude (§7). 


'http://www.planet-lab.org/ 
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Region 


Country 


North America 

Canada, US 

South America 

Argentina, Brazil, Ecuador 

Europe 

Belgium, France, Germany, Greece, Hungary, 


Italy, Netherlands, Norway, Russia, Slovenia, 


Sweden, United Kingdom 

East Asia 

China, Hong Kong, Japan, Korea, Taiwan 

Middle East 

Israel, Jordan, Qatar, Turkey 

Oceania 

Australia, New Zealand 


Table 1: The countries for which we collected data and 
their assigned region. 

2. DATA COLLECTION 

In this section we describe our data collection method- 
ology. We extended Krishnamurthy's Firefox extension [7] 
to log cookies, Etags 2 , and browser local storage. We then 
ran this script against the Alexa top-500 popular websites in 
each country listed in Table 1, storing details of the observed 
third-party for later analysis. All our data was obtained be- 
tween 28 March 2014 and 28 April 2014. To minimise pollu- 
tion between consecutive visits, a bash script creates a new 
user profile and ensures that the local cache is cleared be- 
fore each website is visited and the extension runs. We used 
PlanetLab's infrastructure [8] nodes in 28 different countries 
to gain access across the globe. In addition to the Planet- 
Lab servers, we also ran our scripts on a computer located 
in Qatar as PlanetLab's coverage in the middle-east is not 
as strong as elsewhere. Unfortunately, a paucity of Planet- 
Lab nodes in Africa coupled with the failure of our scripts 
to complete successfully on the few nodes in Africa that we 
could try, we cannot present data pertaining to Africa. 

To identify third-party websites, our Firefox extension em- 
ploys the combination of the domain and adns approaches 
explained by Krishnamurthy & Wills [2]. A third-party site 
is identified as one whose second-level domain and ADNS 
(Authoritative DNS) server differ from the second-level do- 
main name and authoritative DNS server of the origin site. 
Use of the authoritative DNS server allows us to classify 
cases such as bbc.CO.uk and bbci.CO.uk correctly, observ- 
ing that both belong to the same company even though the 
second-level domains are different. 

In visiting the Alexa top-500 websites in 28 countries from 
different regions of the world, we visited a total of 6497 
unique websites and identified 6817 third-party trackers. We 
observed the presence of third-parties on the over 80% of 
the visited websites. Qatar (814), Korea (769) and Hong 
Kong (726) are the top three countries in terms of num- 
ber of third-party trackers, while the United Kingdom (397), 
Jordan (330) and Belgium (274) are the bottom three. We 
group countries into six geographical regions: North Amer- 
ica, South America, Europe, East Asia, Oceania and the 
Middle East. Table 1 shows the investigated countries and 
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Figure 1: The strength of countries in terms of number 
of local third-party services. 
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Figure 2: Web Index ranking vs Locally hosted third- 
parties 

the regions to which they belong. Overall we detect the 
highest numbers of third-party trackers in Europe (3378) and 
East Asia (2009). Normalising by the number of countries in 
each region, we see that the North America, Oceania and the 
Middle East are the regions with the highest average num- 
bers of third-party services. 

3. REGIONAL ANALYSIS 

We begin our regional analysis by counting the number of 
third-parties which are physically hosted in the countries of 
our study. We rely on the geoiplookup utility to determine 
the country in which each observer third-party resides. Our 
results are shown in Figure 1, with circle diameter represent- 
ing the number of third-parties located in each country. We 
can see that locally hosted third-parties in countries across 
Europe, East Asia and Oceania regions are relatively evenly 
distributed, whereas, in North and South America and the 
Middle East there are substantial variations. For example, 
in the Middle East, Turkey and Israel have many more local 
third-parties than other countries in that region. In general 
we found North America, Germany and China with the high- 
est number of locally hosted third-parties. After looking at 
this result one natural question that may arise is the correla- 
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Figure 3: Distribution of aggregated domains presents 
the existence of companies with tens of third -party track- 
ers. 


Company(#Domains) 

Company(#Domains) 

google_family (42) 

elender.hu (9) 

verisigngrs.com (27) 

gabia.com (9) 

microsoft.com (19) 

indom.com (9) 

aoU'amily (18) 

schibsted-it.no (9) 

sakura.ad.jp (17) 

taobao.com (9) 

firstns.de (15) 

tonline.hu (9) 

netnames.net (15) 

iponweb.net (8) 

transip.nl (15) 

knet.cn (8) 

yahoojamily (14) 

sanomaonline.hu (8) 

register.it (13) 

baidujamily (7) 

sina_family (12) 

adresseavisen.no (7) 

conversant Jamily (11) 

atcom.gr (7) 

qq.com (11) 

bbend.com (7) 

registercom (10) 

comodogroup.com (7) 

regtime.net (10) 

ebay.com (7) 


Table 2: Top-30 identified companies with the highest 
number of aggregated domains. 

tion between Web-based advancement and number of locally 
hosted third-parties across countries. To answer this ques- 
tion, we used the Web Index [9] that is provided by WWW 
Foundation led by Tim Berners-Lee. The index , first re- 
leased in 2012 and updated in 2013, measures the contribu- 
tion of Web in 81 countries using four factors: "Universal 
Openness" for communication infrastructure, "Freedom and 
Openness" for citizen rights of information, opinion and on- 
line privacy, "Relevant content" for accessibility of relevant 
information based on gender and language, "Empowerment" 
for impact of the Web on society, economy and politics. Fig- 
ure 2 presents the scatterplot for Web Index ranking against 
locally hosted third-parties per country. We observe that the 
majority of countries with high ranking have actually high 
number of locally hosted third-parties. Turkey, Hungary, 
Russia and China constitute four exceptions with over 100 
locally services while they are ranked below 50. 

We carry on our analysis by identifying dominant third- 
parties in each region after aggregating third-parties within 
their parent company, identified through a combination of 
three methods. First, we used Collusion's dataset [10] to de- 
tect third-parties belonging to the same company. We man- 
ually inspected this dataset for any changes using websites 
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AOL 

aol.com, advertising.aol.com, atwola.com, 
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pictela.net, huffingtonpost.com, huffpost.com, 
huffpo.net, mapquestapi.com, 5min.com, aol- 
cdn.com, goviral-content.com, srvntrk.com blog- 
smithmedia.com, mirabilis.com, mqcdn.com 

Adobe 

omniture.com, 2o7.net, demdex.net 

Amazon 

amazonaws.com, images-amazon.com, cloud- 
front. net 

AudienceScience 

revsci.net, wunderloop.com 

Baidu 

baidu.com, baidustatic.com, haol23.com, 
haol23img.com, bdstatic.com, bdimg.com, 
haol23.com.br 

Burst Media 

burstnet.com, blinkx.com 

ComScor 

voicefive.com, scorecardresearch.com, se- 
curestudies.com, sitestat.com 

Conversant (ValueClick) 

conversantmedia.com, awltovhc.com, 
kdukvh.com, qksrv.net, apmebf.com, ftjcfx.com, 
tqlkg.com, yceml.net, dotomi.com, medi- 
aplex.com, lduhtrp.net 

Facebook 

facebook.com, facebook.net, fbcdn.net 


Google 


doubleclick.net, youtube.com, blog- 

blog.com, android.com, ajax.googleapis.com, 
googlesyndication.com, doubleclick.com, 
youtube.googleapis.com, blogger.com, chan- 
nelintelligence.com, content.googleapis.com, 
googletagmanager.com, 2mdn.net, 
youtube-nocookie.com, blogger- 
comments .googlecode.com, eedburner. com, 
fonts.googleapis.com, googleusercon- 
tent.com, ytimg.com, , blogspot.com, 
gmodules.com, goo.gl, googlevideo.com, 
wordtechnews.blogspot.com, invitemedia.com, 
googleadservices.com, gstatic.cn, ggpht.com, 
orkut.com, googleadsserving.cn, gstatic.com, 
recaptcha.net, google-analytics.com, 
javaplugins.googlecode.com, urchin.com, 
googleapis.com, maps.googleapis.com, 
googlecode.com, translate.googleapis.com, 
google.com, www.googleapis.com, googlecom- 
merce.com 


Nielson 

mrworldwide.com, nielson.com 


Quantcast 

quantcast.com, quantserve.com 


RadiumOne 

radiumone.com, gwallet.com, po.st 


247 Real Media 

realmediadigital.com, realmedia.com, rm- 
lacdn.net, 247realmedia.co.kr 

Sina 

sinajs.cn, sinaimg.cn, leju.com, 
sinauda.com, sinajs.js, wcdn.cn, 
sina.com.cn, sinacdn.com, 
sinahk.net 

weibo.com, 
sinahk.net, 
appsina.com, 

Sizmek 

serving-sys.com, peer39.net, 
ject.com 

republicpro- 

Twitter 

twitter.com, , twimg.com 



Yahoo 


yahoo.com, flickr.com, yieldmanager.com, 
bluelithium.com , overture.com, yahooapis.com, 
staticflickr.com, yldmgrimg.net, maktoob.com, 
xtendmedia.com, yahoo.net, sstatic.net, 
yimg.com, zenfs.com 


Table 3: Top-20 companies and their third-party do- 
mains. 
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and wiki pages of the companies involved. Second, we used 
the e-mail addresses of third-party domains obtained by query- 
ing their SOA (Start of Authority)record (i.e., reapplying the 
adns method). However, the email address is often unhelpful 
if it is a general account from a cloud, CDN or DNS ser- 
vice. For example, awsdns-hostmaster@amazon.com 
is the email address of all third-parties hosted on Amazon 
Web Services, and dns-admin@google.com is assigned 
for all services hosted on Google App Engine. We iden- 
tified the unhelpful email addresses if their email domain 
name belongs to the known CDN and DNS services, or key- 
words in the email domain indicate such services. Intead 
for these cases, we used the organization indicated in their 
whois records when available, else we assumed the third- 
party has no parent company. 

The distribution of aggregations we carried out is shown 
in figure 3. The size of the parent companies varies con- 
siderably: some appear to own tens of third-party trackers 
while others have fewer than five. Table 2 shows the top-30 
identified companies with the highest number of aggregated 
third-parties. The well-known advertising-related (e.g., an- 
alytics, ad trackers) companies are presented in company 
name .family format. Moreover, the aggregated domains of 
such companies are listed in Table 3. We found, unsurpris- 
ingly, that Google, AOL and Yahoo appear to own the largest 
number of third-party trackers. We present the hierarchy of 
the top-four big companies, acquisitions and their trackers in 
Appendix 7. 

As well as the well-known services such as Google, we 
also observed some less well-known third-party services, spread 
across almost all regions. We present the top-20 in each re- 
gion in Figure 4. We found third-party services belonging to 
Google, Amazon and Facebook roughly in the same position 
throughout our investigated regions (top four) while Yahoo, 
compared with other regions, has a notably higher position 
(second place) in Europe (Figure 4(c)) and South America 
(Figure 4(b)). This difference in South America is due to 
the high number of occurrences of the Yahoo third-party re- 
quests in Ecuador (4304; 10% of the third-party websites in 
South America). Similarly, Slovenia, Norway and Hungary 
contribute most in Europe (Figure 4(c)). 

Beside the most famous players, we identified other third- 
party services with extensive presence across all regions. For 
example, scorecardresearch belongs to comScore Inc., an 
analytics company, netdna-cdn, belongs to NetDNA, a CDN 
company, and quantserve belongs to QuantCast, a behavioural 
advertising company, almost appeared in all regions, except 
for the absence of netdna-cdn in East Asia. This presence 
implies a growing competitiveness of such businesses across 
the regions. 

In addition to the global third-party services, we observed 
a notable presence of local third-parties in specific regions 
such as East Asia and Europe. We remind that local third- 
parties are those services which are physically located in the 
related region. In East Asia (Figure 4(f)), 1 1 cases from the 


TLD Number 


.com 

3605 

Country Code 

1654 

.net 

793 

Other (e.g., .biz, .asia) 

444 

org 

114 


Table 4: The proportion of different Top Level Domain 
names of the third-parties. 

top-20 are based in this region (e.g., sina\-family, tabaocdn. 
com); in Europe (Figure 4(c)), 4 services amongst those pre- 
sented are mainly found in European countries (DE-based: 
adtech.de; FR-based: criteo.com,smartadserver.com; GB- 
based badoocdn.com). On the other hand, in Oceania and 
South America, there are far fewer local third-parties (one 
out of top-20) and in the Middle East there are none in the 
top-20. 

We next examine the ecosystem of third-party trackers in 
different regions to find out how this ecosystem looks like 
if we put the dominant and popular players aside. We also 
investigate "unconventional" third-party services and their 
distribution in different regions. In our analysis, we excluded 
all those third-party websites that had a country code or a 
popular TLD name (com, org or net). This left us with about 
4%(= 235) of the total identified third-party trackers. Table 4 
shows the proportion of different TLDs amongst the third- 
parties. 

Figure 5 shows the top- 10 atypical third-parties in each 
region, which appeared in over 50% of the countries of that 
group. It is notable that amongst these atypical services, 
some are globally active. We identified three cases amongst 
the top ten: simpli.fi (a US-based ad tracker), trafficfactory. 
biz (a Netherlands-based advertising agency) and adap.tv (a 
US-based ad broker) that appeared in most of the regions of 
our dataset, denoted by (*) in the above figures. 

Atypical services are almost equally spread across coun- 
tries in Oceania (Figure 5(d)), Europe (Figure 5(c)) and South 
America (Figure 5(b)), whereas in other regions the occur- 
rence of small services is unequal amongst countries of each 
region. For example, in East Asia (Figure 5(f)) and the Mid- 
dle East (Figure 5(e)), Taiwan and Qatar have high occur- 
rence of the services in comparison with other countries in 
their own group. 

In terms of region specific services, we identified a Den- 
mark based ad serving third-party,emediate.eu, which mostly 
provide services in northern and central Europe such as Swe- 
den, Norway, and Germany (Figure 5(c)). We did not ob- 
serve regional small services in other groups. However, the 
presence of some overseas services such as a Spain based 
web hosting, abcimg.es, in South America (Figure 5(b)) 
and US governmental services such as usa.gov in Oceania 
(Figure 5(d)) is of interest. 

4. PER-COUNTRY ANALYSIS 
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Figure 4: Top-20 third-party websites by region. Occurrence count for each third-party is displayed above each bar. 
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Figure 5: Top-10 small third-party websites in East Asia and Middle East. Globally observed sites are indicated by *. 
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Figure 6: Heatmaps showing locations of third-parties, y-axis is the location of the first-party and x-axis is the location 
of the third-party. Darker colours indicate greater presence, and the region of each country in the two left-most plots is 
depicted by the colour of the blue bars on the left and at the top. 


In this section we look at the presence of the overseas 
third-party trackers in each country and region. We focus on 
a specific subset of third-parties which their TLD is a coun- 
try code e.g., the TLD of yadro.ru is the country code of 
Russia, we refer to them as locally named third-parties. For 
this purpose, we exclude all third-parties with non Country 
Code TLD (CCTLD) as well as those which their CCTLD is 
not corresponding to the countries in our list. Our method is 
lower-bound for US-named third-parties because some TLDS 
such as gov is very popular for American domain names 
which we exclude them. We identified 1654 (24%) unique 
third-parties with CCTLD amongst the other TLDs which 
are listed in the table 4. 

We examine the penetration of locally named third-parties 
across popular websites of countries (based on top 500 Alexa 
ranking) where they do not belong to. The heat map in Fig- 
ure 6(a) demonstrates such presence. The y-axis shows the 
country which visited website is popular in, while the x- 
axis corresponds to the CCTLD of third-parties which ap- 
peared in the visited sites. For example, the third row shows 
that the websites which are popular in Turkey embed some 
third-party trackers from Germany, Russia, United States 
and Turkey. In general, we found United States, Russia and 
Germany to be the countries with the locally named third- 
parties across popular websites of almost all countries in 
our dataset. Amongst other European countries, Norwegian 
and Sweden third-parties have a similar and notable pres- 
ence in each other popular websites. One explanation for 
such presence is that a website can be popular in more than 
one country therefor its locally named third-party is consid- 
ered as an overseas in other countries in which the website 
is popular. Another reason can stem from the difference be- 
tween the country which a third-party CCTLD implies and 
the country where it is physically hosted. To investigate 


this possibility, we examined the correspondence between 
CCTLDs and the location of the third-parties. We found 
most of the CCTLDs corresponding to their actual physical 
location. Heat map 6(b) presents this result which is very 
similar to the heat map 6 except for those third-parties that 
their CCTDLs were not corresponding to their physical lo- 
cation. For instance locally named third-parties of Italy and 
Canada amongst popular websites of Qatar in the first row 
of figure6(a) are not present at the corresponding row in the 
figure 6(b) since they were not physically hosted in Italy and 
Canada. On the other hand, US-based locally named third- 
parties appear stronger which is due to the presence of some 
locally named third-parties which their TLD refers to an- 
other country rather than US. The presence of Sweden-based 
third-parties amongst popular websites in China is another 
revealed interesting point in this examination. 

So far we observed the considerable presence of locally 
named third-parties of some specific countries across pop- 
ular websites of various other countries. We carry on our 
investigation to identify overseas third-parties using differ- 
ent approach, based on purely physical location of visited 
websites and locally named third-parties. So that we as- 
sign countries to the visited websites using their physically 
hosted location instead of where they are popular in as we 
did so far. In contrast to US, in countries of South Amer- 
ica there is no overseas third-parties across the websites lo- 
cated there neither third-parties based in these countries be- 
ing present across websites of other countries with slight 
exception for the websites based in North America. Simi- 
lar to the previous examination, we identify the country of 
the locally named third-parties based on their physical lo- 
cation. The heat map of figure 6(c) presents this result. 
Clearly, US has a unique situation; While across the ma- 
jority of countries, with few exceptions, there are consid- 
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erable number of locally named third-parties based in US, 
there are third-parties located in majority of countries which 
are embedded inside US-based websites. Similar to the both 
previous examinations, the presence of locally named third- 
parties hosted in Germany, North America and Russia is high 
amongst websites located in Israel and Turkey. However, we 
donf observe any third-party from these countries amongst 
websites located in the other countries of Middle East (Qatar 
and Jordan) neither amongst other regions except European 
countries and US in North American region. On the other 
hand we observe slight presence of third-parties hosted in 
Middle East countries except Qatar across websites located 
in Great Britain. 

We would like to clarify that the importance of presence 
of overseas third-parties is due to their possible access to the 
users information from various countries who are visiting 
those popular websites. Considering various studies report- 
ing the access of third-party trackers to the user's person- 
ally identifiable information such as full name, email or even 
very sensitive information including user's health condition, 
in addition to the growing trend of Web data surveillance by 
different governments, learning about countries which po- 
tentially have access to user information is helpful to under- 
stand the flow of data collection. 


5. DISCUSSION 

In the previous section, we observed the presence of the 
overseas third-parties located in US, Germany and Russia 
amongst websites of almost all countries. This implies, not 
surprisingly, access to and potentially storage and processing 
of users' data from countries other than those where the first 
party service is hosted. We now briefly examine one hypoth- 
esis for this behaviour, that it is driven by the differing data 
protection and online privacy rules in key countries in those 
regions. Afterwards, we discuss the role of such regulation 
in the presence of third-party services. 

The EU regulatory framework has a clear and compre- 
hensive set of rules for data protection. This means that all 
businesses located in any members of the European Union 
should comply with such regulations. In terms of online pri- 
vacy, according to the Directive 2002/5 8/EC and its amend- 
ment 2009/1 36/EC, known as ePrivacy Directive, websites 
which are using cookies or other technologies to collect user 
data should clearly inform users about such process and ask 
for their opt-in consent as soon as website is loaded on user's 
machine. Similarly, in Australia, any entity that collects per- 
sonal information should notify user about that, however, the 
notification can be provided after actual data collection [11]. 
In US, in contrast to EU and Australia, there is no single, 
specific law that regulates the collection and use of personal 
data. Therefore, the related laws varies in different states as 
well as in different business sectors. The situation in coun- 
tries such as China and Turkey becomes more ambiguous 
since there is no specific data protection law. We summarise 


the current regulation frameworks regarding data protection 
and international data transferring in the Table 5. 

Despite the existence of data protection regulations in many 
countries, and growing attention to the online privacy issues, 
the implementation and enforcement of such rules are not 
consistent with the laws in theory. For example, Germany 
has not implemented ePrivacy Directive, therefore, there is 
no requirement for active opt-in consent, e.g., by clicking on 
a pop-up window. It's suggested that browser cookie settings 
would remain adequate. While in UK having user opt-in 
consent is mandatory. In Russia, data protection rules have 
many similarities with the EU directives, however, the incon- 
sistencies and complexity in the regulations lead to very lim- 
ited enforcement of law. In US, on the other hand, with to- 
tally different approach of jurisdiction system (relying more 
on self-regulatory and guidelines) monitoring businesses is 
more complicated. These differences suggest the effect of 
implementation and enforcement of law on highly presence 
of third-party services in specific countries like US, Ger- 
many and Russia. 

We should note that other factors such as technological 
advancement and political approaches could be influential 
in this field. Germany act as a commercial hub in Europe 
as well as owning the most advanced digital infrastructure 
such as DE.CEX, the largest Internet exchange point in the 
world. Russia based third-parties in Asia and Middle East is 
aligned with the general doctrine of the Russian government 
to broaden relationship with these regions [12]. 

6. RELATED WORK 

A number of studies have analyzed third-party trackers 
from different points of view. Krishnamurthy & Wills [2] 
investigated the expansion of third-party trackers from 2005 
for a period of three years. They showed how tracking has 
changed with time and the acquisitions of various compa- 
nies. They had previously analysed the growing associa- 
tion between first-party and third-parties in [7]. In [13], 
they examined the access of third-parties to personal infor- 
mation based on the category of the first-party website in 
which they are embedded. They found that websites provid- 
ing health and travel-related services disclose more informa- 
tion to third-parties than other types of websites. 

Roesner et al. [14] proposed a framework for classify- 
ing the behaviour of web trackers based on the scope of 
the browsing profile they produce. They show the spread 
of the identified classes amongst the top 500 websites in the 
world. Gomer et al [15] focused on the network aspects of 
third-party trackers in three search markets. They show a 
consistent network structure across different markets as well 
as high efficiency in exchanging information among third- 
parties. Mayer et al [16] surveyed different techniques which 
are used by web trackers to collect user information. 

While the above studies focused on the technical capabili- 
ties of specific types of third-party trackers, our study exam- 
ines the presence of all third-parties across different regions 
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their Binding 
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Information 
Commissioner 
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a cloud service 
provider is plan- 
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to make sure 
data will not be 
misused 

Data can be 
transferred to 
Strasbourg Con- 
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protection of 
personal data 
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on the nature of 
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certain industrial 
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cial banks is 
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be transferred 
overseas 

No specific regu- 
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though individ- 
ual cases may 
have additional 
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Table 5: Comparison of data protection and data transferring across different countries. 


of the world. Kulshrestha et al. [17] show the way in which 
users in the various parts of the world have different (local 
and global) interaction on the Twitter social network. Our 
work is closest to that of Castelluccia et al. [5], which anal- 
yse the top 100 most popular sites worldwide across a num- 
ber of countries, to assess their tracker behaviours. They 
focused on measuring the penetration of US-based services 
in different countries, whereas, we, focus on the regional 
presence of third-party trackers as well as less-known cases. 

From a privacy point of view, Ur et al [18] report users' 
strong concerns about data collection done by ad trackers. 
Moreover, Bellman et al. [19] showed the significant effect 
of culture and national regulation on users' privacy concerns 
and consequently suggests localized privacy policies. In our 
work, we also show the impact of regional characteristics 
on the structure of the third-party ecosystem, and suggest to 
further investigate how privacy policies in this ecosystem are 
affected by the regional regulatory frameworks in place. 

7. CONCLUSIONS 

In this paper, we had presented a study of the geographic 
differences in the third-party ecosystem. We sampled the 
Alexa top-500 most popular websites in each of 28 countries 
across widely spread regions of the world: North America, 
South America, Europe, East Asia, Middle East and Ocea- 
nia. We examined the global and regional presence of the 
large, small and atypical third-party services in each region, 
as well as their penetration into other regions. We exposed 


connections amongst countries within each region by exam- 
ining the geographic presence of third-parties that serve a 
big share of today's web. 

Unsurprisingly, we found overall that a small number of 
international corporations are heavily dominant in all coun- 
tries and regions. We observed significant differences in 
the numbers of observed third-parties across regions, with 
Turkey and Israel in the Middle East region standing out as 
having considerably more local third-parties than most coun- 
tries. We observed considerably greater regional dominance 
of third-parties in Europe and East Asia, perhaps indicat- 
ing greater commercial collaboration among companies in 
countries in those regions. In contrast, presence countries in 
North America is dominated by local third-parties. 

We hope that the findings of our study will help better un- 
derstand the international trade of personal information and 
accordingly adapt privacy protection solutions. Indeed, we 
highlighted the potential influence of regulatory constraints 
on the presence of third-parties. One example is Russia 
where the complexity and ambiguity of privacy regulation 
limits their implementation. Our observations suggest that 
privacy regulation, particularly in the area of cloud comput- 
ing, requires more attention from the regulatory community. 

As further work, we would like to expand the analysis by 
examining the relationships between the third-party and the 
peering ecosystems, especially to shed light on the physical 
presence and deployment of third-parties. Another interest- 
ing further work is to examine in details the type of services 
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provided by third-parties in various regions of the world. Fi- 
nally, we need to find some way to collect data about these 
relationships in Africa. 
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APPENDIX 
Appendix A 

The full list of the identified family companies is shown in 
table 6. 

Appendix B 

The heat map in Figure 7 shows that the most of third-parties 
with CCTLDs are physically located in a country where their 
CCTDL point to. The y-axis represents the location of a 
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Table 6: Hierarchical presentation of top four big companies, acquisitions and their third-party trackers. 


third-party according to its country code, and the x-axis rep- 
resents the physical location of the third-party. Darker colours 
indicate greater presence. 
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Figure 7: Physical location of third-parties vs their 
CCTLD 


